Hackers employed massive compute power and uncensored AI models to infiltrate the cloud platform Railway in an attempt to steal API keys from AI inference providers for use in model distillation attacks. The company disclosed that the intrusion, which occurred between October 20 and October 22, potentially exposed environment variables including database credentials and secrets in approximately 1.85% of its workspaces, or about 100,000 accounts.
In response to the breach, Railway temporarily paused new builds and deployments and invalidated all access tokens. While the provider stated that individual user accounts were not accessed, an incident responder tracked a suspected attacker wallet that moved roughly $371,000 in stolen cryptocurrency across 19 EVM chains following the compromise.
